diff --git a/build.xml b/build.xml
index 46e8c88a..47df1b8f 100644
--- a/build.xml
+++ b/build.xml
@@ -407,6 +407,17 @@
 		<fixcrlf file="${xml.dir}/ukfederation-stats.html" eol="lf"/>
 	</target>
 	
+	<!--
+		Extract TLS locations from the UK federation metadata.
+	-->
+	<target name="extract.locs" depends="gen.uk.unsigned">
+		<echo>Extracting TLS locations</echo>
+		<exec executable="perl" dir="${build.dir}"
+			output="${build.dir}/locations.txt">
+			<arg value="${build.dir}/extract_locs.pl"/>
+		</exec>
+	</target>
+	
 	<!--
 		Extract authorities
 	-->
diff --git a/build/extract_locs.pl b/build/extract_locs.pl
new file mode 100755
index 00000000..bd2a12f2
--- /dev/null
+++ b/build/extract_locs.pl
@@ -0,0 +1,18 @@
+#!/usr/bin/perl -w
+
+open(XML,"java -cp ../xalan-j_2_6_0/bin/xalan.jar org.apache.xalan.xslt.Process -IN ../xml/ukfederation-metadata-unsigned.xml -XSL extract_locs.xsl|") || die "could not open input file";
+while (<XML>) {
+	chop;
+	if (/^https:\/\/([^\/:]+(:\d+)?)(\/|$)/) {
+		my $location = $1;
+		$location .= ":443" unless defined $2;
+		$locations{$location} = 1;
+	}
+}
+close XML;
+
+foreach $loc (sort keys %locations) {
+	if ($loc =~ /([^:]+):(\d+)/) {
+		print "$1 $2\n";
+	}
+}
diff --git a/build/extract_locs.xsl b/build/extract_locs.xsl
new file mode 100644
index 00000000..e1b658df
--- /dev/null
+++ b/build/extract_locs.xsl
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+	extract_locs.xsl
+	
+	XSL stylesheet that takes a SAML 2.0 metadata file and extracts
+	a list of service locations that will have TLS certificates.
+	
+	Author: Ian A. Young <ian@iay.org.uk>
+
+-->
+<xsl:stylesheet version="1.0"
+	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+	xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+	xmlns:shibmeta="urn:mace:shibboleth:metadata:1.0"
+	xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:wayf="http://sdss.ac.uk/2006/06/WAYF"
+	exclude-result-prefixes="shibmeta md ds wayf">
+
+	<!-- Output is plain text -->
+	<xsl:output method="text"/>
+
+	<xsl:template match="//md:AttributeService">
+		<xsl:value-of select="@Location"/>
+		<xsl:text>&#x0a;</xsl:text>
+	</xsl:template>
+	
+	<xsl:template match="//md:ArtifactResolutionService">
+		<xsl:value-of select="@Location"/>
+		<xsl:text>&#x0a;</xsl:text>
+	</xsl:template>
+	
+	<xsl:template match="//md:SingleSignOnService">
+		<xsl:value-of select="@Location"/>
+		<xsl:text>&#x0a;</xsl:text>
+	</xsl:template>
+	
+	<xsl:template match="//md:AssertionConsumerService">
+		<xsl:value-of select="@Location"/>
+		<xsl:text>&#x0a;</xsl:text>
+	</xsl:template>
+	
+	<xsl:template match="text()">
+		<!-- do nothing -->
+	</xsl:template>
+</xsl:stylesheet>